Description

In versions below 2.2.1 of the Splunk Attack Analyzer Connector for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive archive password by invoking either the detonate file or detonate url action, because the action's archive_password parameter is not masked and is shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameter as a password. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-19T22:17:24.587Z",
  "pubdate": "2026-08-19T22:17:24.587Z",
  "executiveSummary": "An information disclosure vulnerability exists in versions below 2.2.1 of the Splunk Attack Analyzer Connector for Splunk SOAR. The vulnerability arises from an unmasked sensitive parameter within the user interface when executing specific security actions. Specifically, the archive_password parameter utilized in the detonate file and detonate url actions fails to implement proper password masking, resulting in cleartext exposure of sensitive archive passwords within the UI. The impact of this vulnerability allows users possessing roles with permissions to run actions to inadvertently view confidential authentication credentials. The risk implications involve potential credential harvesting and lateral exposure within the affected environment. Attacker capabilities are constrained to users who already hold authenticated access with permissions to execute actions. Exploitation requirements mandate that the attacker or user invokes the vulnerable detonate file or detonate url actions, thereby rendering the unmasked archive_password parameter visible in cleartext via the user interface.",
  "technicalDetails": "The root cause of the vulnerability stems from improper input masking configuration within the application's action parameter definitions. Specifically, the vulnerable component is the Splunk Attack Analyzer Connector for Splunk SOAR in versions below 2.2.1, where the affected action parameter, specifically archive_password, is not programmatically designated as a password type. Authentication requirements necessitate that the interacting entity holds a role with explicit permissions to run actions within Splunk SOAR. Privilege requirements are limited to standard operator or user roles possessing action execution capabilities rather than strict administrative privileges. Network exposure is localized to the Splunk SOAR web application interface where action execution results and parameters are rendered to the user. The exploitation method follows a specific attack flow: 1. An authenticated user or malicious actor with action execution privileges navigates to the Splunk SOAR interface. 2. The user initiates either the detonate file or detonate url action associated with the Splunk Attack Analyzer Connector. 3. The user inputs a sensitive archive password into the archive_password parameter field as part of the action configuration. 4. Upon invocation, the application processes the action request but fails to mask the archive_password parameter in the user interface logs or display views. 5. The sensitive archive password is rendered in cleartext directly within the UI elements visible to the user. Post-exploitation impact includes the unauthorized exposure of sensitive credentials, which could potentially be leveraged to access encrypted archives or systems protected by the exposed password if reused across other security domains."
}